(19) 



J 



Europaisches Patentamt 
European Patent Office 
Office europeen des brevets 





(12) 



(45) Date of publication and mention 
of the grant ol the patent: 
03.09.1997 Bulletin 1997/36 

(21) Application number: 94900973.2 

(22) Date of filing: 07.12.1993 



(11) EP 0 686 329 B1 

EUROPEAN PATENT SPECIFICATION 

(51) intci.6: H04L 12/24, H04L 12/26 



(86) International application number: 
PCT/GB93/02502 

(87) International publication number: 

WO 94/19887 (01.09.1994 Gazette 1994/20) 



(54) EVENT CORRELATION IN TELECOIVIMUNICATIONS NETWORKS 

EREIGNISKORRELATION IN UEBERTRAGUNGSNETZEN 

CORRELATION D^EVENEMENT DANS DES RESEAUX DE TELECOMMUNICATIONS 



m 

o> 

CM 
CO 

CD 
00 
CD 

o 

LU 



(84) Designated Contracting States: 

BE CH DE DK ES FR GB IT LI NL SE 

(30) Priority: 23.02.1993 GB 9303640 

(43) Date of publication of application: 
13.12.1995 Bulletin 1995/50 

(73) Proprietor: BRITISH TELECOMMUNICATIONS 
public limited company 

London EC1A7AJ (GB) 

(72) Inventor: WHITNEY, Christopher 
St. Albans, Herts AL3 SOW (GB) 

(74) Representative: Lidbetter, Timothy Guy Edwin 
BT Group Legal Services, 

Intellectual Property Department, 
8th Floor, Holborn Centre, 
120 Holborn 
London EC1N2TE (GB) 



(56) References cited: 

• IEEE INFOCOM *92, PROCEEDINGS 
CONFERENCE ON COMPUTER 
COMMUNICATIONS, vol.2, 2 May 1992, 
FLORENCE (IT) pages 1020 - 1027. XP300237 
SAMEH RABIE 'Integrated network 
management:Technologies and implementation 
experience.' 

• IBM SYSTEMS JOURNAL, vol.31, no.2, 1992, 
ARMONK, NEW YORK US pages 223 - 251 K.D. 
GOTTSCHALK 'NetVlew version 2 release 3 
graphic monitor facility: Network management 
graphics support for the 1990s.* 

• ANNUAL REVIEW OF COMMUNICATIONS 
NATIONAL ENGINEERING CONSORTIUM, 
vol.46, no.92, 1992, CHICAGO (US) pages 752 - 
754, XP322222 MARC SCH WAGER Yemote 
network monitoring MIB.' 

• PROCEEDINGS OF THE INTERNATIONAL 
CONFERENCE IN VIENNA ; DATABASE AND 
EXPERT SYSTEMS APPLICATIONS, 29 August 
1 990, VIENNA ( AU) pages 1 26 - 1 31 
A.MCMICHAEL ET AL. '"Teresa" : An integrated 
system for network diagnoses.' 



Note: Wrthin nine months from the publication of the mention of the grant of the European patent, any person may give 
notice to the European Patent Office of opposition to the European patent granted. Notice of opposition shall be filed in 
a written reasoned statement. It shall not be deemed to have been tiled until the opposition fee has been paid. (Art. 
99(1 ) European Patent Convention). 



Printed by Jouve, 75001 PARIS (FR) 



EP 0 686 329 B1 



Description 

This invention relates to a method of correlating 
events in a telecommunications network. The correla- 
tion method is based on the use of a model of the net- 
work in which at least some of the network elements are 
represented in a computer simulation by respective pro- 
gram modules. The invention finds particular but not ex- 
clusive application in the correlation of transmission net- 
work alarms, that is. the identification of the single most 
probable cause of a group of alarms. 

Telecommunications networks are normally com- 
posed of a hierarchy of various types of equipment or 
network elements, as shown partially in Figure 1 . These 
types include bearers 1 to 5 and multiplexers 6 to 9. Mul- 
tiplexers enable a number of low-speed circuits to be 
carried over a single higher speed bearer. The multi- 
plexed bearer is said to carry a number of tributary cir- 
cuits, for example, a 2-8 multiplexer (6) combines four 
2Mbit/s channels or tributaries on to an 8f\/lbit/s bearer 
The 8Mbit/s bearer can be thought of logically as tour 
tributary circuits. A series of multiplexers, e.g. 2-8 mul- 
tiplexer (6), 8-34 multiplexer (7), 34-1 40 multiplexer (8), 
and a 140-565 multiplexer, (not shown) allow construc- 
tion of the multiplexed hierarchy. There are also skip 
multiplexers, such as the 2-34 multiplexer (9), that step 
up or down two or more transmission rate levels in one 
piece of equipment. A complete end-to-end circuit is 
made up of a number of bearers. 

Multiplexing is used to reduce transmission costs 
by improving bearer media usage (a 565Mbit/s bearer 
circuit can carry 7680 channels) and to decrease the 
number of bearer channels that need to be monitored 
and maintained so improving the manageability of the 
network. 

The pieces of equipment in the network can develop 
faults such as loss of synchronization, power failure or 
degraded signal. The pieces of equipment will send out 
alarm signals which are converted to alarm reports by 
the monitoring systems. Other pieces of equipment de- 
pendent on an item with a fault will also register alarm 
messages as their functioning is prevented by the fault. 
Further equipment dependent on these may also send 
alarms and so on. Thus one higher order piece of equip- 
ment failing can result in a deluge of alarms. It can be 
difficult to identify quickly and accurately the cause of 
all the alarms. 

The purpose of correlation of alarm signals in a tel- 
ecommunications network is to reduce the amount of 
raw information passed on to the network managers and 
to add value to the information that is passed on. As a 
result of correlation, the raw fault reports are processed 
into fewer, richer correlation reports, allowing mainte- 
nance engineers to identity necessary repairs and pri- 
oritise them. 

Correlation in this context means identifying the sin- 
gle probable cause of a group of alarms using informa- 
tion in the alarms themselves and in the model of the 



network. The correlation is performed in real time to pro- 
vide identification of the root cause of the faults. To 
achieve this manually is an arduous and time consum- 
ing task as the monitoring systems can generate a 
s wealth of alarms as a result of a single network fault. 

A particular complication in large networks built up 
over a long period is that not all equipment is monitored, 
or the monitoring systems are inconsistent in the condi- 
tions which cause alarms, so a complete set of alarms 
10 Is unlikely. It is also possible for the airm itself to fail. 
Moreover, the different technologies involved mean that 
not all alarms pertaining to a particular fault will be re- 
ceived at the same time. It is important that such factors 
do not prevent a current correlation being made on the 
IS basis of other alarms. 

Correlation can also be used in contexts other than 
alarm monitoring. For example, it can be used to monitor 
how a system functions, for example monitoring what 
effects occur as a result of network reconfigurations. It 
20 may also be used to identify traffic patterns, for planning, 
market research, or fraud detection purposes. 

Correlation techniques are discussed in general 
terms in, for example, an article by Sameh Rabie "Inte- 
grated Network Management: Technologies and Imple- 
25 mentation experience" (IEEE Infocom '92 Proceedings; 
Conference on Computer Communications;\/o\ 2; 2 May 
1992. Florence. Italy; pages 1020-1027: XP300237. 

According to the present invention there is provided 
a method of correlating events occurring in a telecom- 
30 munications network formed from individual network el- 
ements, at least some of the network elements being 
represented in a computer by individual program mod- 
ules, each program module having a set of data relating 
to the network elements which it represents and, in the 
3S case of at least some of said program modules, the data 
set of the module including 

a) a list of network elements having incoming asso- 
ciations with the network element represented by 

40 the module in respect to event correlation, 

b) a list of network elements having outgoing asso- 
ciations with the network element represented by 
the module with respect to event correlation, and 

c) a parameter indicating the state of activation of 
45 the program module at a point at which events can 

be correlated, 

said method comprising the steps of increasing 
the value of the activation parameter of a program mod- 

50 ule when an event occurs in the network element rep- 
resented by the program module, varying the value of 
the activation parameter of the modules in accordance 
with the lists of associations between the network ele- 
ments in a predetermined manner, and producing a pos- 

55 itive correlation report in a respect of an individual pro- 
gram module when the level of its activation parameter 
exceeds a predetermined threshold. 

According to another aspect there is provided ap- 
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paratusfor correlating events occurring in a telecommu- 
nications network formed from individual network ele- 
ments, the apparatus comprising program module 
means for representing at least some of the network 
elements , each program module having a set of data 
relating to the network elements which it represents and, 
In the case ot at least some of said program modules, 
the data set of the module including 

a) a list of network elements having incoming asso- 
ciations with the network element represented by 
the module in respect to event correlation, 

b) a list of network elements having outgoing asso- 
ciations with the network element represented by 
the module with respect to event correlation, and 

c) a parameter indicating the state of activation of 
the program module at a point at which events can 
be correlated, 

said apparatus comprising 

means, responsive to an event in the network ele- 
ment represented by the program module, for in- 
creasing the value of the activation parameter of a 
program module, 

means, responsive to changes in the value of an 
activation parameter in one program module, for 
varying the value of the activation parameters of 
other modules in a predetermined manner in ac- 
cordance with the lists of associations between the 
network elements, 

means for identifying when the level of the activa- 
tion parameter of an individual program module ex- 
ceeds a predetermined threshold, and 
means for producing a positive correlation report in 
a respect of that individual program module. 

The invention has a number of advantages. Firstly, 
by setting the threshold of the activation parameter ap- 
propriately, the user can balance the sensitivity of to a 
suitable compromise between false, repeated, and 
missed correlations. Secondly, the invention establish- 
es a correlation based solely on the association be- 
tween network elements which have reported an event. 
There is no need to have knowledge of which network 
elements are capable of reporting an event, and a failure 
of one element to report an event does not necessarily 
cause the failure of the correlation. 

In order that correlations only take place between 
events that occur close together in time, the method may 
include the step of causing the activation energy in the 
program modules to decay towards zero in a predeter- 
mined manner. 

In the present invention it can be arranged that a 
positive correlation report is issued when appropriate by 
setting the threshold of the activation parameters to a 
suitable value which balances the need for sensitivity of 
the method in determining correlations whilst not 



swamping the user with repeated correlations before re- 
medial action can be taken. 

An embodiment of the invention wilt now be de- 
scribed, by way of example only, with reference to the 
5 accompanying drawings, in which: 

Figure 1 is a schematic diagram ot digital hierarchy 
network elements in a telecommunications net- 
work; 

10 Figure 2 is a schematic diagram of an alarm corre- 
lation system operating according to the invention; 
Figure 3 is a diagram of a correlation window; 
Figure 4 is a diagram of a logical relationship be- 
tween the elements ofn the network of Figure 1; 

IS Figure 5 is a diagram of another logical relationship 
between the elements of the network of Figure 1 ; 
Figures 6, 7 and 8 show typical decay functions for 
an activation parameter; and 
Figure 9 shows a fragment of a network model. 

20 

The transmission domain of a telecommunications 
network is a suitable candidate for an object-oriented 
representation. There are clearly defined "objects" in the 
domain, both logical and physical. The object-oriented 

25 approach allows these objects to be represented as nat- 
urally as possible. The model of this embodiment uses 
the object oriented approach. 

With the object-oriented approach, individual phys- 
ical network elements or objects are modelled by re- 

30 speclive program modules (software objects). Each pro- 
gram module has a set of data attributes which repre- 
sent the actual attributes of the physical network ele- 
ment. For example, in the case of a programme module 
representing a circuit, the attributes may include the 

35 name of the circuit, the end points of the circuit, the 
bandwidth of the circuit, the circuit type, the name of the 
higher order circuit of which it is a tributary and the 
names of the lower order circuits which it carries. 

The embodiment described below uses a model of 

40 a telecommunications network based on an interpreta- 
tion of the managed objects defined by the Network 
Management Forum (NMF), an industry consortium of 
international computing and network equipment suppli- 
ers, service providers and users and published as "OSl/ 

45 NMF Library of Managed Object Clauses, Name Bind- 
ings and Attributes". This document sets out definitions 
for operable communications network management 
products that support alarm management. The architec- 
ture is based on ISO standards and CCITT recommen- 

50 dations. 

Referring now to Figure 2, there is shown an alarm 
correlation system for a telecommunications network 
which embodies this invention. The correlation system 
includes alarm sources 10 detect alarm correlations in 
55 the individual circuits of the network and sends alarm 
signals to a correlator 11. The correlator 11 correlates 
the alarm signals using a correlation process which will 
be described below and sends the results of correlation 
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to a workstation 13. The correlator 11 uses data trom a 
network configuration model (NCM) 12 having a struc- 
ture corresponding to that of the object-oriented model 
used by the correlator 11 which receives data on the ar- 
rangement and organisation of the network from dispa- 
rate databases 1 4 and converts this data into a common 
format usable by the correlator 11. 

The correlation process used in the correlator 11 
builds on the work described in a paper "SITUATED 
AGENTS CAN HAVE GOALS" by Pattie Maes ("Robotic 
and Autonomous Systems" Volume 6 (1990) pages 
49-70). This paper, which is incorporated herein by ref- 
erence, introduces the concept of ascribing a numerical 
parameter (referred to as "activation energy" in the pa- 
per) to each object of a system. The value of this pa- 
rameter for each object of the system is determined ac- 
cording to rules which depend on the relationships be- 
tween the objects. Each object has two. or more logical 
stales, and a state change is triggered when the object 
reaches an "activation threshold". This state change 
causes changes in the relationships between objects, 
which causes further changes in the activation energy 
of the objects. An external stimulus, such as a require- 
ment for a particular task or "goal" to be achieved, injects 
activation energy into the system. State changes and 
consequent changes in activation energy then take 
place until the state change which is required (the 
"goal") is achieved by the object which represents that 
goal achieving its "activation threshold". 

In this invention the alarms correspond to the exter- 
nal stimuli, and a correlation to a "goal". Thus the gen- 
eration of a number of alarms at different objects will 
cause a correlation to take place for an object associat- 
ed with all the alamied objects, which is likely to be the 
location of the actual fault. 

Important to the correlation process is a determina- 
tion of how long an alarm or a correlation should be 
deemed valid and appropriate for use in correlation. If 
alarms and correlations were to last indefinetely then 
eventually the program modules representing every cir- 
cuit in the network would be activated and the whole 
model would be correlated. To prevent this occurring a 
correlation window may be defined. In Figure 3 time is 
shown along the axis t. Alarm events A1 , ^2.. A3, A4 and 
A5 occur at different times ti , tg, tg, 14 and tg. 

A correlation window is the period T to T^ during 
which a set of alarms are correlated. The lifetime of an 
alarm (e. g. from A2 to X2) must be approximately the 
same length-as the correlation window so that related 
alarms do not appear and disappear without being cor- 
related. However, the lifetime of an alarm should not be 
so great so as to persist in many correlation windows 
and possibly give false results. So, for example alarms 
A1, A2, A3 and A4 will all be correlated with each other 
because they all occur within the window T to TV Alarms 
A3 and A4 will also be correlated with alarm A5 as they 
all occur within the next window. However alarms A1 
and A2 are not correlated with alarm A5 as the time in- 
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terval between A5 and the other two alarms is too great 
to be significant. 

It is desirable for correlation processes to recognise 
that alarms and correlations only have a certain lifetime 

5 in which they are useful and after which they should be 
ignored or removed. 

The present invention is primarily but not exclusive- 
ly concerned with a process for carrying out connective 
correlation on a telecommunications network and this 

10 embodiment takes full advantage of the benefits provid- 
ed by object-orientation in order to achieve this. Con- 
nective correlation is a type of correlation in which com- 
mon associations between data are correlated. In the 
context of a telecommunications network, an example 

IB of this would be that three recent alarms originated from 
individual lower order circuits which are all carried by a 
common higher order circuit. The correlator 11 performs 
connective correlation by exploiting two types of asso- 
ciation between circuit objects contained within the cor- 

20 relator 11 namely a "CARRIED-BY" association and a 
"CARRIES" association. For each program module 
which represents a circuit object, these two associations 
may be part of the set of data attributes which represent 
the actual attributes of the physical circuit object. Alter- 

2S natively, each of these program modules may be pro- 
vided with a portion of code for deriving the associations 
from other data. 

The "CARRIED-BY" association exists between 
two circuit objects A and B if: 

30 

* A is a lower order circuit 

* B is a higher order circuit 

* A is carried by B, that is A is a circuit routed over a 
tributary of B 

35 

The CARRIED-BY association is a one-to-many re- 
lationship, that is a lower order circuit can be carried by 
more than one higher order circuit, as would be the case 
if the lower-order circuit is multiplexed onto another cir- 
40 cuit which is itself further multiplexed onto a further cir- 
cuit. 

Figure 4 illustrates the CARRIED-BY association 
contained within the model used by correlator 11. The 
association identifies a set of higher order circuit objects 

45 that all carry a lower order circuit object. It is this asso- 
ciation that provides the structure to the model as it de- 
fines how circuits are physically related in the actual net- 
work. For example if two 2Mbit/s circuits 21 . 22 are rout- 
ed over an 8Mbit/s circuit 23 in the actual network then 

50 as shown in Figure 4 there will be CARRIED-BY asso- 
ciations between the 2Mbit/s and 8Mbrt/s software cir- 
cuit objects 21 , 22, 23 representing these circuits in the 
model. In the same way if two 8Mbit/s circuits 23. 24 are 
routed over a 34Mbit/s circuit 25 in the actual network, 

55 as shown in Figure 4 then there will be CARRIED-BY 
associations between the corresponding SMbit/s and 
34Mbitys software circuit objects 23, 24, 25. It can be 
seen that it Is these CARRIED-BY associations that pro- 
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vide the object-oriented nnodel of correlator 11 with its 
strict hierarchical structure. Every software circuit object 
is related to other software circuit objects by the CAR- 
RIED-BY association. It should be noted that a lower 
order circuit can be carried by more than one higher or- 
der circuit. For example 2fyibit/s circuits 21 , 22 are car- 
ried by both 8Mbit/s circuit 23, 24. This is possible be- 
cause each circuit is defined as the complete end-to- 
end routing. Between these end points it may be carried 
on several higher-order bearers, some of which them- 
selves may be carried on even higher-order circuits. For 
each software circuit object, the CARRIED-BY associ- 
ations provide a list of outgoing associations relevant to 
correlation. 

A "CARRIES" association exists between two cir- 
cuit objects A and B if: 

* A is a higher order circuit 

* B is a lower order circuit 

* A carries B, that is A has B routed over one of its 
tributaries. 

The CARRIES association also is also a one to 
many relationship. That is a higher order circuit can car- 
ry many lower order circuits. The association identifies 
a set of lower order circuits that are carried over a higher 
order circuit. For example, as shown in Figure 5 If an 
BMbit/s circuit carries two 2Mbit/s circuits 21 , 22 in the 
actual network, there will be CARRIES associations be- 
tween the software circuit objects 23, 21. 22 that repre- 
sent these circuits in the modei used by correlator 11. 
In the same way if a 34Mbit/s circuit carries two 8Mbit/ 
s circuits 23, 24 in the actual network, then as shown in 
Figure 5 there will be CARRIES associations between 
the respective objects 25, 23, 24 in the model. 

As will be described below, the CARRIES associa- 
tion is also used in the correlation process. The CAR- 
RIES association is also used after a correlation has 
been produced to identify all the potentially affected cir- 
cuits. For each software circuit object, the CARRIES as- 
sociations provide a list of incoming associations rele- 
vant to correlation. 

The rationale behind this is that if two circuits are 
alarming and these two circuits are carried by higher or- 
der circuits that are common to the alarming circuits, 
then it may be that these common circuits are at fault 
and should therefore be reported or may become can- 
didates for further correlatbn. 

The attributes of each software circuit object also 
include a parameter which indicates its state of activa- 
tion as the point at which alarms may be correlated. The 
activation parameter corresponds to the activation en- 
ergy described by Maes. 

The correlation process operates as follows. When 
an alarm is received from one of the physical circuit ob- 
jects, the activation parameter for the corresponding 
software circuit object is increased by a fixed amount. 
This causes an increase in the activation parameter in 
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each object associated with the alarming object by the 
CARRIED-BY associations in an attempt to correlate 
higher order objects with linear associations in relation 
to the alarming object. The value of the activation pa- 
5 rameter for each of the software circuit objects on its list 
of outgoing associations is therefore increased. The ac- 
tivation parameters higher order software circuit objects 
are then increased in turn in a similar manner. 

Changes in activation parameter can also be 
10 passed backwards along the CARRIES association to 
software circuit objects whose activation parameters 
have not yet increased. More specifically, when a soft- 
ware circuit object activation parameter increases as a 
result of a change in a lower order software circuit ob- 
15 ject, it causes an increase in the activation parameter of 
each of the software circuit objects of its list of incoming 
associations which have not yet activated. The increase 
in activation parameter caused in this way is not on its 
own enough to trigger the alarm at the receiving object, 
20 but such an object will be triggered if it receives prompts 
in this way from several downstream connections. 

A positive correlation report is produced in respect 
of a particular software circuit object when the level of 
its activation parameter exceeds a predetermined 
25 threshold. 

Generally, alarms produced by lower order circuit 
objects are progressively less relevant to circuit objects 
of progressively higher orders. This is reflected in the 
correlation process of this invention by the fact that a 
30 software circuit object causes a proportionally smaller 
increase in activation parameter in a associated object 
further forwards along its CARRIED-BY associations. 
For example, alarms received by two 2Mbit/s software 
circuit objects may be sufficient to produce a positive 
35 correlation report for an 8/Mbit/s circuit object. In this 
context, it may be necessary for three or more 2 Mbit/s 
software circuit objects to receive alarms before a pos- 
itive correlation report is produced for a 34 Mbit/s circuit 
object. The correlation process is therefore effective 
40 even if some of the physical software objects are not 
monitored for alarm conditions. 

As described previously, alarms and correlations 
are only useful for a predetermined length of time known 
as the correlation window. In order to reflect this, the 
45 activation parameters in the software circuit objects is 
subjected to decay in accordance with a decay function 
as shown in Figure 6, 7 or 8, in which the activation pa- 
rameter level E is shown on the vertical axis and time 
on the horizontal axis. 
50 The fall in activation parameter may be a simple 
step function, as shown in figure 6, corresponding to a 
requirement for the alamn to be correlated only with oth- 
ers occurring within a predetermined period, with all 
such alarms occurring within that period being given 
55 equal weight. More realistically the activation level may 
be arranged to fall in a decay function (e.g. linear as 
shown in figure 7 or asymptotic), such that alarms oc- 
curring further apart in time are given a smaller {but non- 
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zero) weighting than those occurring nearly simultane- 
ously. 

The decay function can take any form suitable for 
the characteristics of the individual system. In most cas- 
es the function will decline monotonicalty (i.e. it will have 
negative gradient throughout) as shown in figure 7 but 
in certain situations zero gradient (Figure 6) or even pos- 
itive gradients are possible; for example if inherent de- 
lays in the system (such as coding delays) result in two 
simultaneous alarms being less likely to have a common 
cause than if they are separated by a short delay. Such 
a decay function is shown in figure 8. in which the energy 
first rises steeply and then decays exponentially to- 
wards zero. 

Any of these functions may be modelled in practice 
as a series of steps. It will be appreciated that such a 
stepwise decline still meets the mathematical definition 
of "monotonic", that is a mathematical function which 
never increases (or one which never decreases). 

The activation parameter lost in the decay may sim- 
ply be lost to the system or it may activate a module to 
alert the user to the uncorrected alarm. 

An example will illustrate how a correlation can be 
produced from alarms on two 2Mbit/s circuits. It will then 
be shown how a positive correlation report for a 34Mbit/ 
s circuit can be produced from a further alarm on a 
2Mbit/s circuit Consider the fragment of the model 
shown in Figure 9. 

The arrival of the first alarm 31 results in a 2Mbit/s 
circuit object 41 causing an increase in activation pa- 
rameter all 8Mbit/s circuit objects 51, 52, 53 that carry 
it. The 8Mbit/s circuit objects 51 , 52, 53 in turn cause an 
increase in activation parameters to all 34Kylbit/s circuit 
objects that carry them, and so on. When the second 
alarm 32 arrives at a 2Mbit/s circuit object 42 it causes 
an increase in activation parameter to the 8Mbil/s circuit 
object 52, 54 that support it. However this time the ac- 
tivation parameter in the 8Mbit/s circuit object 52 cross- 
es its threshold and this results in a positive correlation 
report 71. A further increase in activation parameter is 
again passed forward to circuit object 61. By now the 
34Mbit/s circuit object 61 has received two increases in 
activation parameter but the level of its activation pa- 
rameter has not yet passed its threshold. It causes a 
further increase to the activation parameter of the 8 Mbit/ 
s circuit object 55 that it carries to prompt it to activate. 
The arrival of the third alarm 33 at 2Mbit/s circuit object 
43 results in a further increase in the activation param- 
eter of the 8Mbit/s circuit object 55. Because of its raised 
activation parameter level object 55 can now cause a 
further increase in the activation parameter of the 
34Mbit/s circuit object 61. This time the level of activa- 
tion parameter in the 34Mb it/s circuit object exceeds its 
activation threshold and so a positive correlation report 
72 is produced. 

Once a positive correlation report has been pro- 
duced, an "affected feature" report is also produced. 
This report lists all the circuits that are routed over the 



higher order circuit identified in the positive correlation 
report, i.e. all the circuits affected by this fault. The report 
is generated by using the CARRIES association. The 
report enables network operators to prioritise repair 
5 work and to respond to customer queries about prob- 
lems with their circuits. 



Claims 

10 

1. A method of correlating events occurring in a tele- 
communications network formed from individual 
network elements, at least some of the network el- 
ements being represented in a computer by individ- 
is ual program modules, each program module having 
a set of data relating to the network elements which 
it represents and, in the case of at least some of 
said program modules, the data set of the module 
including 

20 

a) a list of network elements having incoming 
associations with the network element repre- 
sented by the module in respect to event cor- 
relation, 

25 b) a list of network elements having outgoing 

associations with the network element repre- 
sented by the module with respect to event cor- 
relation, and 

c) a parameter indicating the state of activation 
30 of the program module at a point at which 

events can be correlated, 

said method comprising the steps of increas- 
ing the value of the activation parameter of a pro- 
35 gram module when an event occurs in the network 
element represented by the program module, vary- 
ing the value of the activation parameter of the mod- 
ules in accordance with the lists of associations be- 
tween the network elements in a predetermined 
40 manner, and producing a positive correlation report 
in respect of an individual program module when 
the level of its activation parameter exceeds a pre- 
determined threshold. 

45 2. A method as claimed in Claim 1 , in which a change 
in the activation parameter of a program module 
causes a proportionally smaller change in the acti- 
vation parameters of the program modules which 
represent higher order network elements. 

50 

3. A method as claimed in Claim 1 or 2, in which a 
change in the activation parameter of a module 
causes a proportionally smaller change in the acti- 
vation parameters of the program modules which 

55 have not yet activated and which represent lower 
order network elements. 

4. A method as claimed in any one of the preceding 
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claims, including the step of causing the activation 
parameter in the program modules to vary with time 
in a predetermined manner in addition to the varia- 
tions in the activation parameters made in response 
to events in the network elements. ^ 

5. A method as claimed in claim 4, wherein the varia- 
tion with time of the activation parameter of at least 

one module is a monotonic decay- 
to 

6. A method as claimed in claim 4 or 5. wherein the 
activation parameter of at least one module initially 
rises, and then decays monotonically. 

7. A method as claimed in any one of the preceding 
claims, in which at least some of the program mod- 
ules represent physical circuits. 

8. A method as claimed in any preceding claim where- 
in the events occurring in the network are alarm sig- 20 
nals indicating fault conditions detected in the cor- 
responding network elements. 

9. A method as claimed in claim 8. wherein a positive 
correlation report identifies the network element in 25 
which lies the fault that has caused the alarm sig- 
nals. 

10. A method as claimed in claim 8 or 9, wherein a pos- 
itive correlation report identifies all network ele- 30 
ments affected by the fault causing the alarm sig- 
nals. 

11. Apparatus for correlating events occurring in a tel- 
ecommunications network formed from individual 35 
network elements, the apparatus comprising pro- 
gram module means for representing at least some 

of the network elements , each program module 
having a set of data relating to the network elements 
which it represents and, in the case of at least some 40 
of said program modules, the data set of the module 
including 

a) a list of network elements having incoming 
associations with the network element repre- 4S 
sented by the module in respect to event cor- 
relation. 

b) a list of network elements having outgoing 
associations with the network element repre- 
sented by the module with respect to event cor- 50 
relation, and 

c) a parameter indicating the state of activation 
of the program module at a point at which 
events can be correlated, 

55 

said apparatus comprising 
means, responsive to an event in the network 



element represented by the program module, 
for increasing the value of the activation param- 
eter of a program module, 
means, responsive to changes in the value of 
an activation parameter in one program mod- 
ule, for varying the value of the activation pa- 
rameters of other modules in a predetermined 
manner in accordance with the lists of associ- 
ations between the network elements, 
means for identifying when the level of the ac- 
tivation parameter of an individual program 
module exceeds a predetermined threshold, 
and 

means for producing a positive correlation re- 
port in a respect of that individual program mod- 
ule. 

12. Apparaus as claimed in claim 1 1 , further comprising 
means for causing the activation parameter in the 
program modules to vary with time in a predeter- 
mined manner. 

13. Apparatus as claimed in claim 11 or 12 wherein the 
means responsive to events occurring in the net- 
work are responsive to fault detectors associated 
with the corresponding network elements. 

1 4. Apparatus as claimed in claim 1 1 , 1 2 or 1 3, in which 
at least some of the program modules represent 
physical circuits of the telecommunications system. 



PatentansprOche 

1. Verfahren zum Korrelieren von Ereignissen, die in 
einem Telekommunikationsnetzwerkauftreten, das 
aus einzelnen Netzwerkelementen besteht, wobei 
zumindest einige der Netzwerkelemente in einem 
Computer durch einzelne Programnnodule gebildet 
werden, von denen jedes einen Datensatz hat, der 
sich auf das Netzwerkelement bezieht. das es dar- 
stellt. wobei fur zumindest einige der Programmo- 
dule der Datensatz des Moduls aufweist 

a) eine Liste von Netzwerkelementen, die im 
Hinblick auf E reign iskorrelation mit dem durch 
das Modul dargestellten Netzwerkelement eine 
einlaufende Zuordnung haben, 

b) eine Liste von Netzwerkelementen, die in be- 
zug auf Ereigniskorrelation mit dem durch das 
Modul dargestellten Netzwerkelement eine 
auslaufende Zuordnung haben, und 

c) einen Parameter, der den Aktivierungsstatus 
des Programmoduls an einer Stelle angibt, an 
der Ereignisse korrellert werden konnen, 

wobei das Verfahren die Schritte aufweist des Er- 
hohens des Werts des Aktivierungsparameters ei- 
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nes Programmoduls, wenn in dem durch das Pro- 
grammodul dargesteliten NeUwerkelement ein Er- 
eignis auftritt, des Veranderns des Werts des Akti- 
vierungsparameters des Moduls entsprechend den 
Listen der Zuordnungen zwischen den Netzwerk- 
elementen in einer vorbestimmten Weise, und des 
Erzeugens eines positiven Korrelationsberichts be- 
zuglich eines einzelnen Programmoduls, wenn die 
Hohe seines Aktivierungsparameters einen vorbe- 
stimmten Schwellenwert uberschreitet. 

2. Verlahren nacli Anspruch 1 . bei dem eine Anderung 
des Aktivierungsparameters eines Programmoduls 
eine proportional kleinere Anderung der Aktivie- 
rungsparameter von Programmodulen bewirkt, die 
hdherrangige Netzwerkelemente darstellen. 

3. Vertahren nach Anspruch 1 oder 2, bei dem eine 
Anderung des Aktivierungsparameters eines Mo- 
duls eine proportional kleinere Anderung der Akti- 
vierungsparameter von Programmodulen bewirkt, 
die noch nicht aktiviert sind und die tieferrangige 
Netzwerkelemente darstellen. 

4. Vertahren nach einem der vorhergehenden Anspr 0- 
che, mit dem Schritt des Bewirkens einer Verande- 
rung des Aktivierungsparameters eines Programm- 
moduls im Lauf der Zeit in vorbestimmter Weise zu- 
satzlich zu den Veranderungen der Aktivierungspa- 
rameter nach MaBgabe von Ereigntssen in den 
Netzwerkelementen. 

5. Vertahren nach Anspruch 4, bei dem die zeitliche 
Veranderung des Aktivierungsparameters zumln- 
dest eines Moduls eine monotone Abnahme ist. 

6. Vertahren nach einem der Anspruche 4 oder 5, bei 
dem der Aktivierungsparameter zumindest eines 
Moduls anfanglich ansteigt und dann monoton ab- 
nimmt. 

7. Vertahren nach einem der vorhergehenden Anspru- 
che, bei dem zumindest einige der Programmodule 
tatsachlich vorhandene Schaltungen darstellen. 

8. Vertahren nach einem der vorhergehenden Anspru- 
che, bei dem die im Netzwerk auftretenden Eretg- 
nisse Alarmsignale sind, die Fehlerbedingungen 
darstellen, die in entsprechenden Netzwerkele- 
menten erfaOl wurden. 

9. Vertahren nach Anspruch 8, bei dem ein positiver 
Korrelationsbericht das Netzwerkelement identifi- 
ziert, in dem der Fehler liegt. der die Alarmsignale 
bewirkt hat. 

10. Vertahren nach Anspruch 8 oder 9, bei dem ein po- 
sitiver Korrelationsbericht ail diejenigen Netzwerk- 



elemente identifiziert, die durch den Fehler betrot- 
fen sind, der die Alarmsignale bewirkt hat. 

1 1 . Vorrtchtung zum Korrelieren von Ereignissen, die in 
5 einem Telekommunikationsnetzwerk auttreten, das 
aus einzelnen Netzwerkelementen besteht, wobei 
die Vorrichtung Programmoduimittet autweist zum 
Darstellen mindestens einiger der Netzwerkele- 
mente, wobei jedes Programmodul einen Daten- 
10 satz hat, der sich aut das Netzwerkelement bezieht, 
das es darstellt, wobei fur zumindest einige der Pro- 
grammodule der Datensatz des Moduls autweist 

a) eine Liste von Netzwerkelementen, die im 
IS Hinblick auf Ereigniskorrelation mit dem durch 

das Modul dargesteliten Netzwerkelement eine 
einlaufende Zuordnung haben, 

b) eine Liste von Netzwerkelementen, die in be- 
zug auf Ereigniskorrelation mit dem durch das 

20 Modul dargesteliten Netzwerkelement eine 

auslaufende Zuordnung haben, und 

c) eine Parameter, der den Aktivierungsstatus 
des Programmoduls an einer Stelle angibt, an 
der Ereignisse korreliert werden konnen, 

25 

wobei die Vorrichtung 

auf ein Ereignis in dem Netzwerkelement, das 
von dem Programmodul dargestellt wird, ansprech- 
empfindliche Mittel zum Erhohen des Werts des Ak- 
30 tivierungsparameters eines Programmoduls, 

auf Anderungen des Werts des Aktivierungs- 
parameters in einem Programmodul ansprechemp- 
findliche Mittel zum Verandern des Werts des Akti- 
vierungsparameters anderer Module entsprechend 
35 den Listen der Zuordnungen zwischen den Netz- 
werkelementen in einer vorbestimmten Weise, 

Mittel zum Erkennen, wenn die Hohe des Ak- 
tivierungsparameters eines einzelnen Programmo- 
duls einen vorbestimmten Schwellenwert uber- 
40 schreitet, und 

Mittel zum Erzeugen eines positiven Korrela- 
tionsberichts bezuglich dieses einzelnen Pro- 
grammoduls umfa3t. 

45 12. Vorrichtung nach Anspruch 11, ferner umfassend 
Mittel zum Bewirken einer Veranderung des Aktivie- 
rungsparameters eines Programmoduls im Lauf der 
Zeit in vorbestimmter Weise. 

50 13. Vorrichtung nach Anspruch 11 oder 12. bei der die 
auf Ereignisse in dem Netzwerk ansprechempfind- 
lichen Mittel auf Storungsmelder, die den entspre- 
chenden Netzwerkelementen zugeordnet sind, an- 
sprechempfindlich sind. 

55 

14. Vorrichtung nach Anspruch 11, 12 oder 13, bei der 
mindestens einige der Programmodule physikali- 
sche Schaltungen des Telekommunikationssy- 
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stems darstellen. 



Revendications 



1 . Procede de correlation d'6v6nements apparaissant 
dans un r6seau de telecommunications form6 d'6l6- 
ments de reseau individuals, ou au moins certains 
des elements de r6seau sont repr6sent6s dans un 
ordinateur par des modules de programme indivi- 
duels, chaque module de programme pr6sentant un 
ensemble de donnees se rapportant aux elements 
de reseau qu'il repr^sente et, dans le cas d'au 
moins certains desdits modules de programme. 
I'ensemble de donnees du module comprenant 

a) une liste des elements de r6seau comportant 
des associations entrantes avec r616ment de 
reseau represent^ par le module en cequi con- 
cerne la correlation d'6venements, 

b) une liste des 6l6ments de reseau comportant 
des associations sortantes avec I'element de 
reseau repr6sente par le module, en ce qui con- 
cerne la correlation d'6venements. et 

c) un parametre indiquant I'etat d'activation du 
module de programme en un point ou des eve- 
nemenls peuvenl etre correles, 

ledit procede comprenant les etapes consis- 
tant a augmenter la valeur du parametre d'activa- 
tion d'un module de programme lorsqu'un evene- 
ment apparaitdans I'element de reseau represents 
par le module de programme, a faire varier la valeur 
du parametre d'activation des modules conforme- 
ment aux listes des associations entre les elements 
de reseau, d'une maniere prevue, et produire un 
compte-rendu de correlation positive concernant un 
module de programme individuel lorsque le niveau 
de son parametre d'activation depasse un seuil pre- 
vu. 

2. Procede selon la revendication 1, dans lequel un 
changement du parametre d'activation d'un module 
de programme provoque un changement propor- 
tionnellement plus petit des parametres d'activation 
des modules de programme qui representent des 
elements de reseau d'ordre plus eieve. 

3. Procede selon la revendication 1 ou la revendica- 
tion 2, dans lequel un changement du parametre 
d'activation d'un module provoque un changement 
proportionnellement plus petit des parametres d'ac- 
tivation des modules de programme qui n'ont pas 
encore ete activ6s etqui representent des elements 
de reseau d'ordre interieur. 

4. Procede selon Tune quelconque des revendications 
precedentes, comprenant retape consistant ^ame- 
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ner le parametre d'activation des modules de pro- 
gramme a varier dans le temps d'une maniere pre- 
vue en plus des variations des parametres d'activa- 
tion faites en reponse aux 6venements dans les ele- 
ments de reseau. 

5. Procede selon la revendication 4, dans lequel la va- 
riation dans le temps du parametre d'activation d'au 
moins un module est une decroissance monotone. 

6. Procede selon la revendication 4 ou 5, dans lequel 
le parametre d'activation d'au moins un module 
croit initialement, puis decroit de fagon monotone. 

15 7. Procede selon Tune quelconque des revendications 
precedentes, dans lequel au moins certains des 
modules de programme representent des circuits 
physiques. 

20 8. Procede selon I'une quelconque des revendications 
precedentes, dans lequel les evenements se pro- 
duisant dans le reseau sont des signaux d'alarme 
indiquant des conditions de detaut detectees au ni- 
veau des elements de reseau correspondants. 

25 

9. Procede selon la revendication 8, dans lequel un 
compte-rendu de correlation positive identifie I'eie- 
ment de reseau dans lequel est s(tu6 le detaut qui 
a provoque les signaux d'alarme. 

30 

10. Procede selon la revendication 8 ou 9, dans lequel 
un compte-rendu de correlation positive identifie 
tous les elements de reseau affectes par le detaut 
provoquant les signaux d'alarme. 

35 

1 1 . Appareil de correlation d'evenements apparaissant 
dans un reseau de telecommunications forme d'eie- 
ments de reseau individuels, I'appareil comprenant 
des moyens du module de programme pour repre- 

40 senter au moins certains des elements de reseau, 
chaque module de programme presentant un en- 
semble de donnees se rapportant aux elements de 
reseau qu'il represente et. dans le cas d'au moins 
certains desdits modules de programme, I'ensem- 

45 ble de donnees du module comprenant 



50 



55 



a) une liste des elements de r6seau comportant 
des associations entrantes avec I'eiement de 
reseau represente par le module en ce qui con- 
cerne la correlation d'evenements, 

b) une liste des elements de reseau comportant 
des associations sortantes avec reiement de 
reseau represente par le module en ce qui con- 
cerne la correlation d'evenements, et 

c) un parametre indiquant retat d'activation du 
module de programme en un point ou des eve- 
nements peuvent etre correies. 
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ledit appareil comprenant 

des moyens, qui repondent a un evenement 
dans I'element de r6seau represente par le module 
de programme, pour augmenter la valeur du para- 
metre d'activation d'un module de programme, 5 

des moyens, qui repondent a des change- 
ments de la valeur d'un paramfetre d'activation d'un 
module de programme, pour faire varier la valeur 
des parametres d'activation d'autres modules con- 
tormement aux tistes des associations enlre les 6le- io 
ments de r6seau, d'une manifere pr6vue, 

des moyens pour identifier quand le niveau du 
parametre d'activation d*un module de programme 
individuel d6passe un seuil pr6vu, et 

des moyens pour produire un compte-rendu ^5 
de correlation positive concernant ce module de 
programme individuel. 

12. Appareil selon la revendication 11 , qui comprend en 
plus des moyens qui amenent le parametre d'acti- 20 
vation des modules de programme k varier dans le 
temps d'une maniere pr6vue. 

13. Appareil selon la revendication 11 ou 12, dans le- 
quel les moyens qui repondent aux evenements se ^5 
produisant dans le reseau repondent aux detec- 
teurs de defaut associes aux elements de reseau 
correspondants. 

14. Appareil selon la revendication 11, 12 ou 13, dans 30 
lequel au moins certains des modules de program- 
me representent des circuits physiques du systeme 

de telecommunications. 

35 
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